First, the behaviour with notSupported and CMP2.0 is undefined per-spec (and strongly discouraged).

If you use read-only, the data loading process (from the DB) *will* take place in the DB transaction but will *not* be locked at the *application server* level (we are not speaking about the database level here).